Content filtering of remote file-system access protocols

Abstract

Methods and systems for content filtering of remote file-system access protocols are provided. According to one embodiment, a remote file-system access protocol request issued by a client to a server is received at a network device logically interposed between the client and the server. The request is issued to the server by the network device. A single shared holding buffer, used for both read and write accesses to the file and used by multiple processes running on the client, is implemented by the network device for the file during a remote file-system access protocol session. Data being read from or written to the file as a result of the request is buffered into the buffer. Responsive to a predetermined event in relation to the remote file-system access protocol or the buffer, the existence or non-existence of malicious, dangerous or unauthorized content is determined by performing content filtering on the buffer.

What is claimed is: 
     
       1. A method comprising:
 receiving, at a network device, logically interposed between a client and a server, a remote file-system access protocol request from the client, the remote file-system access protocol request representing a request to access a file associated with a share of the server; 
 issuing, by the network device, the remote file-system access protocol request to the server on behalf of the client; 
 implementing, by the network device, a single shared holding buffer for the file during a remote file-system access protocol session, wherein the single shared holding buffer is used for both read and write accesses to the file and is used for accesses to the file by a plurality of processes running on the client; 
 buffering, by the network device, into the single shared holding buffer data being read from or written to the file as a result of the remote file-system access protocol request; and 
 responsive to a predetermined event in relation to the remote file-system access protocol or the single shared holding buffer, determining, by the network device, the existence or non-existence of malicious, dangerous or unauthorized content contained within the holding buffer by performing content filtering on the single shared holding buffer. 
 
     
     
       2. The method of  claim 1 , wherein the remote file-system access protocol comprises Server Message Block (SMB)/Common Internet File System (CIFS). 
     
     
       3. The method of  claim 1 , wherein the single shared holding buffer is stored in a shared memory of the network device that is accessible by a plurality of processes running within the network device. 
     
     
       4. The method of  claim 1 , further comprising tracking, by the network device, usage and modification of the single shared holding buffer with a usage table. 
     
     
       5. The method of  claim 4 , wherein the usage table contains information indicative of free and filled sections of the single shared holding buffer. 
     
     
       6. The method of  claim 5 , wherein the predetermined event comprises determining the single shared holding buffer is full. 
     
     
       7. The method of  claim 1 , further comprising recording, by the network device, data read from the server in a second holding buffer, wherein the second holding buffer is logically linked to the single shared holding buffer. 
     
     
       8. The method of  claim 7 , further comprising the tracking, by the network device, usage of the second holding buffer with a second usage table. 
     
     
       9. The method of  claim 7 , further comprising restoring, by the network device, the file on the server from a clean copy of the file maintained in the second buffer. 
     
     
       10. The method of  claim 9 , wherein the clean copy is the first read from a given block of the file. 
     
     
       11. A network device comprising:
 a memory having stored therein one or more routines; 
 one or more processors configured to perform a method of handling remote file-system access protocol requests issued by a client to a server by executing the one or more routines, wherein the method comprises: 
 receiving a remote file-system access protocol request from the client, the remote file-system access protocol request representing a request to access a file associated with a share of the server; 
 issuing the remote file-system access protocol request to the server on behalf of the client; 
 implementing a single shared holding buffer for the file during a remote file-system access protocol session, wherein the single shared holding buffer is used for both read and write accesses to the file and is used for accesses to the file by a plurality of processes running on the client; 
 buffering into the single shared holding buffer data being read from or written to the file as a result of the remote file-system access protocol request; and 
 responsive to a predetermined event in relation to the remote file-system access protocol or the single shared holding buffer, determining the existence or non-existence of malicious, dangerous or unauthorized content contained within the holding buffer by performing content filtering on the single shared holding buffer. 
 
     
     
       12. The network device of  claim 11 , wherein the remote file-system access protocol comprises Server Message Block (SMB)/Common Internet File System (CIFS). 
     
     
       13. The network device of  claim 11 , wherein the single shared holding buffer is stored in a shared memory of the network device that is accessible by a plurality of processes running within the network device. 
     
     
       14. The network device of  claim 11 , wherein the method further comprises tracking usage and modification of the single shared holding buffer with a usage table. 
     
     
       15. The network device of  claim 14 , wherein the usage table contains information indicative of free and filled sections of the single shared holding buffer. 
     
     
       16. The network device of  claim 15 , wherein the predetermined event comprises determining the single shared holding buffer is full. 
     
     
       17. The network device of  claim 11 , wherein the method further comprises recording data read from the server in a second holding buffer, wherein the second holding buffer is logically linked to the single shared holding buffer. 
     
     
       18. The network device of  claim 17 , wherein the method further comprises tracking usage of the second holding buffer with a second usage table. 
     
     
       19. The network device of  claim 17 , wherein the method further comprises restoring the file on the server from a clean copy of the file maintained in the second buffer. 
     
     
       20. The network device of  claim 19 , wherein the clean copy is the first read from a given block of the file.